@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/compliance/audit-trails/auditable-events.shared.schema.js

@@ -1,12 +1,18 @@
+import { AuditApplicationReadAccess } from './audit-trail-config.shared.schemas.js';
+import { ExternalAssuranceAssessmentSchema } from '../../external-providers/provider-authentication-assurance.shared.schemas.js';
 import { z } from "zod";
+import { ExternalProvider_Connection_DelegationMode } from "@wildo-ai/external-connectors-models";
+import { GovernedDocumentInteractionSchema } from "../documents/governed-document-interactions.shared.schemas.js";
 import { PersonalDataCategory } from "../privacy/personal-data-category.shared.schemas.js";
+import { RegistrationAcquisitionChannel } from "../../config/entity-identity-config.shared.schemas.js";
 import { ResourceOperationRiskLevel, ResourceOperationVariantType } from "../../resources/resources.shared.schemas.js";
 import { CoreResourceOperation } from "../../resources/resources.shared.core.definitions.js";
-import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantStatus, } from "../../security/authorizations/platform-access-grants.shared.schemas.js";
-import { ExecutionContext_ExecutionType } from "../../runtime/execution-context.shared.schemas.js";
+import { PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantScope, PlatformAccessGrantStatus, } from "../../security/authorizations/platform-access-grants.shared.schemas.js";
+import { SystemOfRecordPartitionAssignmentTransition } from "../../systems-of-record/system-of-record-partition-assignments.shared.schemas.js";
+import { ExecutionContext_ExecutionType, ExecutionContext_MachineCredentialSchema } from "../../runtime/execution-context.shared.schemas.js";
 import { AuthScopeType, SsoConnectionType, } from "../../security/authentications/authentication.shared.schemas.js";
 import { WebhookEndpointProbeOutcome } from "../../notifications/m2m/webhook-config.shared.schemas.js";
-import { ProviderCredentialDeletionReason, ProviderCredentialResolutionSource, } from "../../security/connected-accounts/provider-credentials.shared.schemas.js";
+import { ProviderCredentialDeletionReason, ProviderOAuth2RevocationOutcomeValues, ProviderCredentialResolutionSource, } from "../../security/connected-accounts/provider-credentials.shared.schemas.js";
 export var CoreAuditableEventType;
 (function (CoreAuditableEventType) {
     // Authentication Events
@@ -106,6 +112,11 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["ORGANIZATION_CREATED"] = "organization_created";
     // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
     CoreAuditableEventType["ORGANIZATION_UPDATED"] = "organization_updated";
+    /**
+     * The engine assigned an organization its `type`, at boot, with no actor — see
+     * {@link AuditableEvent_Organization_TypeAssignedEventDataSchema} for why this is not an `ORGANIZATION_UPDATED`.
+     */
+    CoreAuditableEventType["ORGANIZATION_TYPE_ASSIGNED"] = "organization_type_assigned";
     CoreAuditableEventType["ORGANIZATION_DELETED"] = "organization_deleted";
     /** The tenant was MARKED for deletion (soft-delete). Its access dies here; its data dies at the purge. */
     CoreAuditableEventType["ORGANIZATION_DELETION_REQUESTED"] = "organization_deletion_requested";
@@ -168,11 +179,47 @@ export var CoreAuditableEventType;
     // SSO Authentication Events
     CoreAuditableEventType["USER_SSO_LOGIN"] = "user_sso_login";
     CoreAuditableEventType["USER_SSO_LOGIN_FAILED"] = "user_sso_login_failed";
+    /**
+     * A tenant that mandates its identity provider refused a local sign-in or an acquisition.
+     *
+     * Emitted since #1214/#1242 by `_enforceEnterpriseSsoOnLocalFirstFactor` (every local first-factor
+     * door), by the grace-login gate's three refusal clauses, and by the registration door's
+     * `blockForSSODomains` block. `enforcementPolicy` carries WHICH clause refused, because "the tenant
+     * allows no fallback" and "this account has spent its grace logins" have different remedies and a
+     * bare `sso_required` cannot tell them apart.
+     *
+     * ONE refusal site remains unwired and is tracked on #1242: the SOCIAL-vs-enforcement refusal in
+     * `oauth2-authentication.backend.service.ts`, whose sibling provider-restriction refusal ten lines
+     * below it already emits `logOAuth2ProviderBlocked`.
+     *
+     * Deliberately NOT emitted by the fail-closed refusals that share the same error — a Redis read
+     * that failed, the outer catch. Those are infrastructure outcomes, and recording them as an
+     * enforcement decision would assert a policy judgement nobody made.
+     */
     CoreAuditableEventType["USER_SSO_ENFORCEMENT_BLOCKED"] = "user_sso_enforcement_blocked";
     CoreAuditableEventType["USER_TOKEN_REFRESHED"] = "user_token_refreshed";
     // Organization Security Management Events
+    // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
+    // Every SSO-config write is HIGH or CRITICAL (UPDATE, CREATE, and the three domain-ownership verbs),
+    // and its authentication-authority blocks carry `.isAuditEvidence()`, so the row names what changed
+    // and its before/after values. Its emit method had no caller and was removed (#591).
     CoreAuditableEventType["ORGANIZATION_SSO_CONFIGURATION_CHANGED"] = "organization_sso_configuration_changed";
+    /** A change to where an organization's security events are exported: enabled, or a field other than the destination edited. INFO. */
     CoreAuditableEventType["ORGANIZATION_SIEM_EXPORT_CONFIGURED"] = "organization_siem_export_configured";
+    /**
+     * Security-event export was turned OFF (#986). Its own kind, at CRITICAL, because the envelope's rule
+     * is that severity is a property of the event TYPE and danger rides the row's `riskLevel` — and
+     * `riskLevel` never reaches the SIEM. As one INFO kind, "export disabled" was filtered out by any
+     * organization that raised its severity minimum, on the one destination that most needed it.
+     * Delivered to the destination that STOPPED, as its last event (`dispatchToRetiredSiemSink`).
+     */
+    CoreAuditableEventType["ORGANIZATION_SIEM_EXPORT_DISABLED"] = "organization_siem_export_disabled";
+    /**
+     * Security-event export was re-pointed at another destination (#986). WARNING: a destination move is
+     * how an attacker who reached the tenant's administration diverts the trail. Delivered to BOTH the
+     * old and the new destination.
+     */
+    CoreAuditableEventType["ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED"] = "organization_siem_export_destination_changed";
     // Organization Provider Credential Events
     //
     // An organization's OWN credential toward a third party. The four verbs are separate members
@@ -223,6 +270,7 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["ORGANIZATION_PROVIDER_CONNECTION_GRANTED"] = "organization_provider_connection_granted";
     CoreAuditableEventType["USER_PROVIDER_CONNECTION_GRANTED"] = "user_provider_connection_granted";
     // Application Security Configuration Events
+    // Also records the effective authored audit-viewer admission policy, with independently typed before/after evidence.
     // The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout
     // requirements) is STATIC application configuration authored in code and taken into effect at
     // backend startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is
@@ -245,9 +293,17 @@ export var CoreAuditableEventType;
     // SCIM Directory Provisioning Events
     // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
     CoreAuditableEventType["SCIM_TOKEN_CREATED"] = "scim_token_created";
+    // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
+    // `revoke_token` is a HIGH operation and `isActive` carries `.isAuditEvidence()`. Its emit method had no
+    // caller and was removed (#591), so a requirement body must not demand this member.
     CoreAuditableEventType["SCIM_TOKEN_REVOKED"] = "scim_token_revoked";
+    // audit-event-unemitted: covered by the generic row — `generate_token` is HIGH. See SCIM_TOKEN_REVOKED.
     CoreAuditableEventType["SCIM_TOKEN_GENERATED"] = "scim_token_generated";
+    // audit-event-unemitted: covered by the generic row — `rotate_token` is HIGH. See SCIM_TOKEN_REVOKED.
     CoreAuditableEventType["SCIM_TOKEN_ROTATED"] = "scim_token_rotated";
+    // audit-event-unemitted: covered by the generic `RESOURCE_OPERATION_PERFORMED` row — see USER_CREATED.
+    // The provisioning-config UPDATE is HIGH and `autoCreateUsers`, `autoDeactivateUsers`, `defaultRole`,
+    // `organizationUnitMapping` and `defaultUnitRole` carry `.isAuditEvidence()`. Emit method removed (#591).
     CoreAuditableEventType["SCIM_PROVISIONING_CONFIG_UPDATED"] = "scim_provisioning_config_updated";
     CoreAuditableEventType["SCIM_PROVISIONING_FAILED"] = "scim_provisioning_failed";
     CoreAuditableEventType["SCIM_USER_PROVISIONED"] = "scim_user_provisioned";
@@ -306,6 +362,17 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["SAML_EMAIL_CHANGED"] = "saml_email_changed";
     // OAuth2 Provider Restriction Events (Phase G3)
     CoreAuditableEventType["OAUTH2_PROVIDER_BLOCKED"] = "oauth2_provider_blocked";
+    /**
+     * An enterprise OIDC login was refused because the identity provider did not report the
+     * authentication context the connection DEMANDED (issue #444).
+     *
+     * `acr_values` is a REQUEST parameter: the relying party asks, the provider decides, and the ID
+     * token's `acr` claim reports what actually happened. So a refusal here is the only evidence that
+     * a step-up demand was made and not met — without it an operator debugging "why can this person
+     * not sign in" sees an ordinary authentication failure and has nothing to distinguish it from a
+     * wrong password.
+     */
+    CoreAuditableEventType["OIDC_ACR_DEMAND_UNSATISFIED"] = "oidc_acr_demand_unsatisfied";
     // One-Off Session Events (W7.3b)
     /**
      * File upload grant lifecycle (issue #312) — the first FILE-domain audit events. A grant is a
@@ -318,6 +385,15 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["FILE_UPLOAD_GRANT_ISSUED"] = "file_upload_grant_issued";
     CoreAuditableEventType["FILE_UPLOAD_GRANT_REDEEMED"] = "file_upload_grant_redeemed";
     CoreAuditableEventType["FILE_UPLOAD_GRANT_REVOKED"] = "file_upload_grant_revoked";
+    /**
+     * File share links (#1567). A share is a bearer link that serves ONE file to whoever holds it, with no
+     * session at all — the widest disclosure the file plane can make, so minting one is audited like a
+     * grant. `ISSUED` carries the file, its owning record/field binding, the expiry and the use budget —
+     * never the token value. `REVOKED` is "stop sharing this file" (`DELETE /files/:fileId/shares`) and
+     * carries how many live links it ended; a revocation that ended none records nothing.
+     */
+    CoreAuditableEventType["FILE_SHARE_LINK_ISSUED"] = "file_share_link_issued";
+    CoreAuditableEventType["FILE_SHARE_LINKS_REVOKED"] = "file_share_links_revoked";
     // File content-inspection outcomes (#506)
     /**
      * A scanner concluded that an uploaded file is INFECTED, and the file was quarantined.
@@ -413,6 +489,27 @@ export var CoreAuditableEventType;
     CoreAuditableEventType["RESOURCE_OPERATION_DENIED"] = "resource_operation_denied";
     CoreAuditableEventType["CROSS_TENANT_ADMINISTRATIVE_ACCESS"] = "cross_tenant_administrative_access";
     CoreAuditableEventType["PLATFORM_ACCESS_GRANT_LIFECYCLE"] = "platform_access_grant_lifecycle";
+    /**
+     * A remote partition of a system of record was assigned to, moved between, or removed from an
+     * organization unit.
+     *
+     * ONE event for the whole life of the edge, with a {@link SystemOfRecordPartitionAssignmentTransition}
+     * field — the `platformAccessGrants` shape rather than three event types. Three types would put the
+     * same row's timeline in three buckets a reviewer has to reassemble, and the questions an auditor
+     * actually asks ("who has been able to see the German company, and since when?") are answered by
+     * reading one bucket in order.
+     *
+     * ## Why this exists beside the automatic row
+     *
+     * All three write verbs are HIGH, which is inside `AUTOMATIC_AUDIT_RISK_FLOOR`, so
+     * `RESOURCE_OPERATION_PERFORMED` already fires for each. What that row cannot carry is the thing a
+     * reviewer needs: which unit, and — on a move — which unit it was BEFORE. A generic operation row
+     * says an assignment changed; this one says what it changed from and to.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — the reach of each remote partition is recorded.
+     * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — evidence of the full life of that reach.
+     */
+    CoreAuditableEventType["SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE"] = "system_of_record_partition_assignment_lifecycle";
     /**
      * An operator enumerated an APPLICATION-WIDE directory — a collection read that is deliberately
      * not confined to any one tenant.
@@ -470,6 +567,8 @@ export var CoreAuditableEventType;
     // is more sensitive than a read, so it is audited as its own distinct event
     // rather than folded into SYSTEM_CONTEXT_READ.
     CoreAuditableEventType["SYSTEM_CONTEXT_WRITE"] = "system_context_write";
+    /** Platform owner publication of application/service configuration; safe field names, caller and outcome only. */
+    CoreAuditableEventType["PLATFORM_CONFIGURATION_PUBLICATION"] = "platform_configuration_publication";
     // Retained-Data (Impersonalization) Access Events
     // Emitted when a privileged SEE-THROUGH read reveals RETAINED (impersonalized-and-retained) records
     // that the default retention hide-predicate keeps hidden. SYSTEM_CONTEXT_READ names only the RUNTIME
@@ -486,6 +585,28 @@ export var CoreAuditableEventType;
     // and what was in it?". The four routed export operations this capability replaced emitted
     // NOTHING at all, which is the gap this closes. Classified DATA_ACCESS / WARNING: an authorized
     // but maximally-sensitive disclosure, not an anomaly.
+    // A person MET a governed document — was shown a notice, acknowledged one, accepted terms,
+    // gave or withdrew a consent — and WHICH RELEASE they met (issue #54).
+    //
+    // The identity is the point. `documentRef` + `releaseId` + `releaseVersion` names a file in a
+    // commit, so a reviewer asking "what exactly did this person accept" reads the terms as they
+    // stood rather than as they stand now. Nothing here is digest-sealed: the previous lane's
+    // interaction RECEIPTS were removed with the rest of the sealed publication machine on
+    // 2026-08-28, and `.claude/rules/one-source-of-truth.md` Rule 0 keeps none of it.
+    //
+    // Classified USER_LIFECYCLE / INFO, beside USER_REGISTERED, because it records a change in the
+    // person's relationship with the OPERATOR rather than a read of data or an access decision.
+    // INFO because recording an acceptance is routine expected activity whose whole value is that the
+    // trail can be queried years later; an alarm on it would fire on every registration. What is NOT
+    // routine rides the payload instead — `releaseApprovalState` says whether anybody had approved
+    // the document at the moment a person was bound by it.
+    //
+    // assurance-control: WILDO.PRIVACY.CONSENT_RECORD — a person's decision about a governed document is
+    // recorded against the exact release version in force at that instant, together with the notice they
+    // were given before being asked (`acceptanceMode`) — or, when the surface declared none, an advisory
+    // saying so. It does NOT claim the document was SHOWN: only `EXPLICIT_AFTER_READING` presents it, and
+    // the other two modes link it (#1382).
+    CoreAuditableEventType["GOVERNED_DOCUMENT_INTERACTION_RECORDED"] = "governed_document_interaction_recorded";
     CoreAuditableEventType["SUBJECT_DATA_EXPORT"] = "subject_data_export";
     // A resource LISTING was exported to a file (CSV/JSON) by an operator. Distinct from
     // SUBJECT_DATA_EXPORT, which answers a data subject's own right over their own data: this one is
@@ -527,6 +648,97 @@ export var CoreAuditableEventType;
     // USER_LIFECYCLE / CRITICAL: one event per acknowledged resource per erasure, never a standing
     // posture.
     CoreAuditableEventType["HTTP_API_NON_ERASURE_ACKNOWLEDGED"] = "http_api_non_erasure_acknowledged";
+    // The application CALLED a declared operation on a third-party provider — one event per outbound
+    // call, on both the success and the failure path.
+    //
+    // Distinct from the three HTTP_API_* members above, which are the ETL read-through plane: those
+    // record a RESOURCE whose rows live elsewhere being read or erased through a binding. This is the
+    // other door — a custom backend service naming a provider and an operation directly — and the
+    // question it answers is the first question of any provider incident: WHOSE third-party account
+    // did we spend, on whose behalf, and what came back. `connectionOwnerScope`/`connectionOwnerId`
+    // are what the initiator's own ids cannot answer, because one execution may legitimately spend
+    // several tenants' accounts (a user action fanning out to every organization that user belongs to
+    // issues N calls with N owners under ONE initiator).
+    //
+    // Distinct from `*_PROVIDER_CREDENTIAL_USED`, which records that a stored credential was SPENT and
+    // what the vendor thought of it. That one is about the CREDENTIAL's health and is emitted by the
+    // store; this one is about the ACT and is emitted by the executor. A credential incident reads
+    // both, in that order, and folding them would make "which calls did this credential make" a query
+    // nobody can write.
+    //
+    // Classified DATA_ACCESS / INFO for the read-through member's reason — routine, authorized
+    // activity whose value is the queryable trail, not an alarm. The READ/WRITE axis rides
+    // `classification` in the payload and the per-emission `riskLevel`, never the static severity.
+    //
+    // assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound call made on a user's behalf is
+    // recorded with the real initiating user carried through whichever account it spent.
+    CoreAuditableEventType["PROVIDER_OPERATION_CALL"] = "provider_operation_call";
+    // A signed-in person's BROWSER asked for a provider operation and the door REFUSED it (#367).
+    //
+    // A sibling of `PROVIDER_OPERATION_CALL`, not a failure case of it, because nothing was called: the
+    // refusal happens before any catalogue lookup, credential read or outbound request, so the call
+    // member's required `method`, `domain` and `classification` do not exist for it — an operation the
+    // application never declared browser-reachable may not even be in the catalogue. What it records is
+    // an ACCESS DECISION, which is the other half of "record access decisions" for this door, exactly as
+    // `RESOURCE_OPERATION_DENIED` is for the resource authorizer.
+    //
+    // Classified AUTHORIZATION / WARNING for that sibling's reason: a refusal is not routine traffic, and a
+    // run of them against one operation is a person probing what a browser can make the backend do.
+    //
+    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — refusals at the browser door to a
+    // third-party operation are attributable and reviewable.
+    CoreAuditableEventType["PROVIDER_OPERATION_DENIED"] = "provider_operation_denied";
+    // An AGENT reached an MCP server on somebody's behalf (#491).
+    //
+    // A sibling of `PROVIDER_OPERATION_CALL`, not a case of it, and the split is the same one that
+    // separates that member from `*_PROVIDER_CREDENTIAL_USED`: they identify different acts. A
+    // provider operation is a CATALOGUE operation — it has an `operationId`, a `domain`, an HTTP
+    // method and a declared READ/WRITE classification. An MCP tool has none of those: the tool list is
+    // discovered from the server at turn start, the transport is always a JSON-RPC POST, and nothing
+    // declares in advance what a tool does. Folding them would make "which catalogue operations ran"
+    // a query that returns tools that are not catalogue operations.
+    //
+    // The ATTRIBUTION fields are deliberately identical, so a reviewer asking "what did this person's
+    // delegated credential do at that vendor" writes one shape of query across both.
+    //
+    // Classified DATA_ACCESS / INFO for the same reason as its sibling: routine authorized activity
+    // whose value is the queryable trail rather than an alarm. A refused outbound TARGET is carried on
+    // the same event through `failureKind`, because an attempted egress a guard blocked is exactly
+    // what a reviewer wants beside the calls that succeeded.
+    //
+    // assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the
+    // real initiating user carried through whichever account it spent.
+    CoreAuditableEventType["MCP_TOOL_CALL"] = "mcp_tool_call";
+    // A human APPROVER changed a proposed tool call's arguments and approved the changed call (#566).
+    //
+    // The strongest act available on the approval plane, and the reason it is its own member rather
+    // than a flag on some broader "approval decided" event: on every other decision the approver
+    // ASSENTS to a call the model authored, and here they AUTHOR one the model never proposed. An
+    // incident reader asking "who wrote the arguments this tool ran with" is asking a different
+    // question from "who let it run", and folding the two would make the first unanswerable by query.
+    //
+    // Emitted ONLY when the executed input differs from the proposed one. An ordinary approval is not
+    // this event and is deliberately not recorded here — the plane has no approval-decision trail at
+    // all yet, which is a separate gap with its own issue; adding half of one under this name would
+    // make `mcp_tool_call`'s mistake in the other direction, an event that answers two questions and
+    // neither well.
+    //
+    // NAMES AND DIGESTS ONLY — never argument values. Identical reasoning to
+    // `RESOURCE_OPERATION_PERFORMED`'s `changedFields` / `fieldEvidence` split: audit rows replicate
+    // to the per-org SIEM and to an immutable ledger that cannot be scrubbed, so copying arbitrary
+    // tool arguments here would manufacture an unerasable duplicate of whatever a person typed, in
+    // direct conflict with GDPR Art. 17. The two digests prove executed ≠ proposed; the key names say
+    // WHICH arguments a person authored. Neither can leak content.
+    //
+    // Classified AUTHORIZATION / WARNING. Authorization because the act IS a human authorization
+    // decision, not a data access. WARNING rather than CRITICAL for the same reading the OAuth grant
+    // rows take: it is notable, dashboard-worthy and worth reviewing, and it is an AUTHORIZED action
+    // taken by an identified person with the pause in front of them — reserving CRITICAL for the rows
+    // that mean something is wrong is what keeps a severity filter usable.
+    //
+    // assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — the approver who authored the
+    // executed arguments is recorded beside proof that they differed from the proposal.
+    CoreAuditableEventType["AGENT_TOOL_APPROVAL_MODIFIED"] = "agent_tool_approval_modified";
     // ── OAuth2 / OIDC Provider Events (Wildo AS the authorization server) ──
     // Distinct from the `OAUTH2_*` family above, which records Wildo CONSUMING an
     // EXTERNAL social OAuth provider. These record the app-issued OAuth2/OIDC provider
@@ -649,6 +861,67 @@ export function describeAuditVocabulary(lead, meanings) {
     const legend = Object.entries(meanings).map(([value, words]) => `- \`${value}\`: ${words.meaning}`).join('\n');
     return `${lead}\n\nValues:\n${legend}`;
 }
+/**
+ * Why the browser door to a provider operation refused a request (#367). A CLOSED vocabulary: the door
+ * resolves exactly one of these per refusal, in the order listed, and a reviewer groups by it.
+ *
+ * Deliberately NOT a reuse of {@link ResourceOperationDenialReason}. The two doors ask different
+ * questions of different declarations — that one checks an operation variant's roles and a row's scope,
+ * this one checks an application's browser-reachability policy and whose third-party account is named —
+ * and sharing members would make "insufficient roles" mean two things in one column.
+ */
+/**
+ * What a provider operation's `requiredScopes` check concluded for one call (#979).
+ *
+ * Carried on {@link AuditableEvent_ProviderOperationCall_EventDataSchema} only when the operation declares required
+ * scopes; an operation declaring none carries no scope field at all, rather than a verdict about nothing.
+ */
+export var ProviderOperationScopeCheck;
+(function (ProviderOperationScopeCheck) {
+    /** The grant recorded its scopes and every required one is among them. The call proceeded. */
+    ProviderOperationScopeCheck["VERIFIED"] = "verified";
+    /**
+     * The spent credential records no granted scopes — a pasted key, the application's own credential, or a vendor
+     * that did not echo `scope`. The call proceeded UNCHECKED, and this row is what says so.
+     */
+    ProviderOperationScopeCheck["NOT_RECORDED"] = "not_recorded";
+    /** The grant recorded its scopes and lacks at least one required scope. The call was refused before any request. */
+    ProviderOperationScopeCheck["MISSING"] = "missing";
+})(ProviderOperationScopeCheck || (ProviderOperationScopeCheck = {}));
+export var ProviderOperationDenialReason;
+(function (ProviderOperationDenialReason) {
+    /**
+     * The caller authenticated without a person — an application API key, a machine identity. This door
+     * exists for a signed-in person's browser, and the policy's roles and the target-authorization port
+     * both reason about a person; a backend caller has the executor and the typed client instead.
+     */
+    ProviderOperationDenialReason["MISSING_USER_SESSION"] = "missing_user_session";
+    /**
+     * The application's `providers.browserOperations` names no policy for this provider and operation.
+     * The fail-closed default: nothing is reachable from a browser unless declared. Also the answer for an
+     * operation that does not exist, so a refusal never reveals what a catalogue contains.
+     */
+    ProviderOperationDenialReason["NOT_BROWSER_REACHABLE"] = "not_browser_reachable";
+    /** The request names a connection shape — owner scope × delegation — the operation's policy does not admit. */
+    ProviderOperationDenialReason["CONNECTION_NOT_ADMITTED"] = "connection_not_admitted";
+    /**
+     * The policy declares roles and the target is the caller's OWN user account, over which nobody holds a
+     * role. A policy mistake rather than a caller's, recorded as its own reason so it is not read as a
+     * person lacking a role they could be granted.
+     */
+    ProviderOperationDenialReason["ROLES_NOT_APPLICABLE_TO_TARGET"] = "roles_not_applicable_to_target";
+    /**
+     * The target-authorization port refused: the caller named an organization they do not belong to
+     * organization-wide, or a user account that is not their own.
+     */
+    ProviderOperationDenialReason["TARGET_NOT_AUTHORIZED"] = "target_not_authorized";
+    /**
+     * The caller may act for the account, and holds none of the policy's roles — after hierarchy
+     * expansion, in the scope of that account. Checked AFTER {@link TARGET_NOT_AUTHORIZED}, so a person
+     * naming a tenant they do not belong to is recorded as that, not as a person short of a role.
+     */
+    ProviderOperationDenialReason["INSUFFICIENT_ROLES"] = "insufficient_roles";
+})(ProviderOperationDenialReason || (ProviderOperationDenialReason = {}));
 /**
  * Why the authorizer refused an operation. A CLOSED vocabulary — the authorizer resolves exactly
  * one of these per refusal, and a SOC dashboard groups by it.
@@ -660,6 +933,20 @@ export function describeAuditVocabulary(lead, meanings) {
  */
 export var ResourceOperationDenialReason;
 (function (ResourceOperationDenialReason) {
+    /**
+     * The application requires consent purposes before it may be used
+     * (`compliance.serviceConsentRequirement`), and this person has not granted them (#534). The person is
+     * authenticated and may hold every role the operation needs; what is missing is their own decision.
+     * Distinct from every role/scope reason, because the remedy is the person's choice, not an administrator's.
+     */
+    ResourceOperationDenialReason["SERVICE_CONSENT_REQUIRED"] = "service_consent_required";
+    /**
+     * ONE operation declared the purpose its own processing rests on
+     * (`ResourceOperationConsentGateDeclaration`), and this person has not granted it (#1258 Step 3).
+     * Distinct from {@link SERVICE_CONSENT_REQUIRED}: only this operation was refused, never the whole
+     * application.
+     */
+    ResourceOperationDenialReason["CAPABILITY_CONSENT_REQUIRED"] = "capability_consent_required";
     /**
      * No initiator identity or roles on the execution context. Fail-closed: the authorizer refuses
      * rather than assuming an anonymous caller.
@@ -710,6 +997,85 @@ export var ResourceOperationDenialReason;
      * becoming an existence oracle.
      */
     ResourceOperationDenialReason["SUBJECT_NOT_RESOLVABLE"] = "subject_not_resolvable";
+    /**
+     * The caller holds the ROLE but no usable APPLICATION-WIDE elevation.
+     *
+     * Its own member rather than `INSUFFICIENT_ROLES`, and the distinction is the whole point of the
+     * grant model: the caller IS an administrator and the refusal is about STANDING privilege, not
+     * about authority. Folding it into the roles reason would make the two indistinguishable in the
+     * trail — and a reviewer asking "did zero-standing-privilege actually bite anyone?" would have no
+     * way to count it.
+     *
+     * Distinct from a tenant crossing refused for the same shape of reason: that one is refused inside
+     * `authorizeOrganizations` and surfaces as `SCOPE_MISMATCH`, because there the caller genuinely is
+     * outside the tenant. Here there is no tenant to be outside of.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["APPLICATION_WIDE_ELEVATION_MISSING"] = "application_wide_elevation_missing";
+    /**
+     * The caller tried to GRANT authority it does not itself hold — a privilege-escalation attempt,
+     * refused by the role-ceiling gate (`assertRequestedRolesWithinCallerCeiling`).
+     *
+     * Its own member rather than {@link INSUFFICIENT_ROLES}, for the same reason
+     * {@link APPLICATION_WIDE_ELEVATION_MISSING} is: the caller PASSED the operation's role check —
+     * an `ORG_ADMIN` really may update a membership — and was refused on the CONTENT of the write.
+     * Folding the two together would make the single refusal an access review most wants to see
+     * indistinguishable from the everyday "you are not an admin", and a reviewer asking "has anyone
+     * tried to escalate?" would have nothing to count.
+     *
+     * Uniquely among the members here, the row carries {@link
+     * AuditableEvent_ResourceOperationDenied_EventDataSchema.escalatedRoles} — the roles that were
+     * actually asked for. `requiredRoles` and `initiatorRoles` cannot express it: neither is the set
+     * the caller tried to confer on somebody else.
+     *
+     * Raised OUTSIDE the authorization phase — the gate runs in custom-implementation prefixes, after
+     * the authorizer has returned — so it does not reach `classifyAuthorizationDenial`. The gate emits
+     * it directly through the same chokepoint, keeping the dedup window, the logarithmic escalation
+     * ladder and the loss counters.
+     *
+     * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — an attempt to grant authority the caller does
+     * not hold is refused AND recorded.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["ROLE_CEILING_EXCEEDED"] = "role_ceiling_exceeded";
+    /**
+     * A high-impact action was refused because the operation ITSELF demands a fresh re-proof of
+     * identity (`requiresStepUpAuthentication`), and the caller presented none.
+     *
+     * The caller is authenticated and may hold every role the operation needs. What is missing is a
+     * ceremony, so this belongs with {@link SERVICE_CONSENT_REQUIRED} rather than with
+     * {@link INSUFFICIENT_ROLES}: the remedy is an act by the same person, not a grant by an
+     * administrator.
+     *
+     * Paired with {@link STEP_UP_REQUIRED_BY_FRESHNESS} for the reason the two consent members are
+     * paired — the missing thing is the same and the party that DEMANDED it is not, and the two read
+     * very differently in a review. A burst of these is somebody repeatedly attempting an action the
+     * application has declared dangerous; a burst of the other is sessions ageing out.
+     *
+     * Raised OUTSIDE the authorization phase, like {@link ROLE_CEILING_EXCEEDED}: the step-up gate is
+     * a private check at the services-registry tier that throws without passing through the
+     * authorizer, so it reaches no `classifyAuthorizationDenial`. It emits through the same chokepoint
+     * instead, keeping the dedup window, the escalation ladder and the loss counters.
+     *
+     * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a refused high-impact action is
+     * recorded, not merely refused.
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["STEP_UP_REQUIRED_BY_OPERATION"] = "step_up_required_by_operation";
+    /**
+     * The same refusal, demanded by the USER TYPE's freshness policy (`UserTypeAuthPolicy.stepUpAuth`)
+     * rather than by the operation: the caller's authentication is older than the declared maximum age.
+     *
+     * Distinct from {@link STEP_UP_REQUIRED_BY_OPERATION} because the two send a reviewer to different
+     * places — one to the operation's own declaration, the other to the user-type policy — and because
+     * only this one varies with how long a person has been signed in. The refusal's own error context
+     * already carried the distinction before either was audited; this keeps it in the durable record.
+     *
+     * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+     */
+    ResourceOperationDenialReason["STEP_UP_REQUIRED_BY_FRESHNESS"] = "step_up_required_by_freshness";
 })(ResourceOperationDenialReason || (ResourceOperationDenialReason = {}));
 /** SSO configuration change type. */
 export var SsoConfigChangeType;
@@ -777,7 +1143,32 @@ export var MachineAccessOperation;
     MachineAccessOperation["A2A_TASKS_LIST"] = "a2a_tasks_list";
     MachineAccessOperation["MCP_TOOLS_LIST"] = "mcp_tools_list";
     MachineAccessOperation["MCP_TOOLS_CALL"] = "mcp_tools_call";
+    /**
+     * A MACHINE principal's READ / LIST / SEARCH on a DECLARED cross-tenant REST door
+     * (`admitsCrossTenantPlatformAdministration`) — today the application audit-log door.
+     *
+     * Deliberately NOT every REST call a machine makes: the plain resource API is audited per operation
+     * through `RESOURCE_OPERATION_PERFORMED`, which carries `machineCredentialId`. These three exist because a
+     * declared crossing's only other row, `CROSS_TENANT_ADMINISTRATIVE_ACCESS`, is written per TENANT REACHED —
+     * so a machine read returning only application-wide rows, or nothing, left no row naming who read (#297).
+     * One member per verb, like the A2A task members: a LIST enumerates, a READ fetches a row somebody named.
+     */
+    MachineAccessOperation["API_READ"] = "api_read";
+    MachineAccessOperation["API_LIST"] = "api_list";
+    MachineAccessOperation["API_SEARCH"] = "api_search";
 })(MachineAccessOperation || (MachineAccessOperation = {}));
+const API_READ_MACHINE_ACCESS_OPERATIONS = {
+    [CoreResourceOperation.READ]: MachineAccessOperation.API_READ,
+    [CoreResourceOperation.LIST]: MachineAccessOperation.API_LIST,
+    [CoreResourceOperation.SEARCH]: MachineAccessOperation.API_SEARCH,
+};
+/**
+ * The MACHINE_ACCESS identifier for an executed REST read, or `undefined` for any verb that is not one.
+ * The one place the core-operation → audit-vocabulary mapping lives, so a recorder never spells it.
+ */
+export function resolveApiReadMachineAccessOperation(operation) {
+    return operation === undefined ? undefined : API_READ_MACHINE_ACCESS_OPERATIONS[operation];
+}
 export const AuditableEventTypeSchema = z.union([
     z.enum(CoreAuditableEventType),
     z.string()
@@ -908,9 +1299,9 @@ export const AuditableEvent_MachineAccess_EventDataSchema = z.object({
      * single authorization axis; recorded so a SIEM sees the authority the access ran under.
      */
     roles: z.array(z.string()).optional(),
-    /** ResourceServerKind of the surface accessed: `a2a` | `mcp`. */
+    /** ResourceServerKind of the surface accessed: `a2a` | `mcp` | `api` (a declared cross-tenant REST read). */
     resourceServer: z.string(),
-    /** The resource-server audience / agent endpoint / systemRef the token was bound to and hit. */
+    /** A2A/MCP: the resource-server audience / agent endpoint / systemRef hit. `api`: the resource type read. */
     resourceIdentifier: z.string().optional(),
     /** Normalised MachineAccessOperation value (e.g. `a2a_message_send`, `mcp_tools_call`). */
     operationIdentifier: z.string(),
@@ -1160,6 +1551,15 @@ export const AuditableEvent_OrganizationMember_RoleChangedEventDataSchema = z.ob
     /** Which write path produced the change — the operation identifier (`create`, `update`, …). */
     operation: z.string(),
     changedBy: z.string(),
+    /**
+     * The actor's stated reason, on the paths that REQUIRE one — today `grantOwnership`, the
+     * platform-tier repair door that crosses into a tenant the caller is not a member of. There the
+     * justification is the whole control: no downstream check can second-guess an operator acting
+     * outside the tenant, so the record of WHY is what makes the crossing accountable. It was required
+     * on the request and discarded at the service boundary until #593. Absent on `create` / `update`,
+     * which collect none. Bounded by the request DTO (1000 characters).
+     */
+    justification: z.string().optional(),
 });
 /**
  * Per-unit role assignment on an `ORGANIZATION_UNIT_MEMBERS` row.
@@ -1367,6 +1767,104 @@ export const AuditableEvent_Organization_UpdatedEventDataSchema = z.object({
     changes: z.record(z.string(), z.any()),
     updatedBy: z.string(),
 });
+/**
+ * WHY an organization was assigned the type it now carries, when no person chose it.
+ *
+ * A closed vocabulary, deliberately named rather than implied: the assignment is only defensible because the answer
+ * was DERIVED, and a reader of the audit row must be able to see which derivation produced it without re-deriving
+ * the application's configuration — or its membership rows — as they stood at that boot. The two members answer
+ * from different evidence, which is exactly why a single "derived" value would not do: one is a fact about the
+ * DECLARATION and stays true however the tenant changes, the other is a fact about the ORGANIZATION on one day.
+ */
+export var OrganizationTypeAssignmentBasis;
+(function (OrganizationTypeAssignmentBasis) {
+    /**
+     * The application declares exactly one organization type, so an organization whose type resolves to nothing —
+     * none stored, or one the declaration no longer carries — can only be that type: it is the only policy the
+     * application has. Nothing is guessed, and nothing about the organization was read.
+     */
+    OrganizationTypeAssignmentBasis["SOLE_DECLARED_TYPE"] = "sole_declared_type";
+    /**
+     * The application declares several organization types, and exactly one of them covers every user type held by
+     * this organization's own members — so the others are types this organization cannot be. Nothing is guessed: it
+     * is the coverage test the first-administrator organization's type is already derived by, asked of the members.
+     *
+     * Narrower than {@link SOLE_DECLARED_TYPE} in what it proves. It reports the answer for the membership as it
+     * stood at that boot; an organization whose members later span two declared types would not derive again. That is
+     * why the row records the basis rather than only the outcome — a reviewer asking "could this have been wrong?"
+     * needs to know which question was answered.
+     */
+    OrganizationTypeAssignmentBasis["MEMBER_USER_TYPES"] = "member_user_types";
+    /**
+     * An operator promoted this organization to the one that OWNS the application, through
+     * `organizations.promoteToOwnerOrganization` (#1054).
+     *
+     * The odd one out of the three, and deliberately kept in the same event rather than given its own.
+     * What the event records is "this organization's `type` changed, and here is what decided it" — true
+     * of all three — and an access reviewer asking "how did this tenant come to be typed this way?" must
+     * find one row wherever the answer lies, not two events they have to know to look for separately.
+     *
+     * What differs is everything a derivation does not have: there IS an actor (the audit row carries
+     * them, and {@link AuditableEvent_Organization_TypeAssignedEventData.justification} carries their
+     * stated reason), the previous type is always present, and the decision was a human's. A row
+     * carrying this basis is the only one on which `justification` may appear — the other two are
+     * derivations, and a derivation has nothing to justify.
+     */
+    OrganizationTypeAssignmentBasis["OPERATOR_PROMOTION"] = "operator_promotion";
+})(OrganizationTypeAssignmentBasis || (OrganizationTypeAssignmentBasis = {}));
+/**
+ * An organization whose type resolved to nothing — none stored, or one no longer declared — was assigned one by the
+ * engine at boot.
+ *
+ * ## Why this is its own event rather than an `ORGANIZATION_UPDATED`
+ *
+ * An organization's type is not a label. It decides which user types its members hold, which authentication
+ * methods they may use, and which step-up policy applies to them — so assigning one changes what every member of
+ * that tenant can do at sign-in. Folded into a generic `changes` map it would be an authentication-relevant
+ * change with no actor, filed where an access review does not look.
+ *
+ * ## Who the actor is, per basis
+ *
+ * For the two DERIVATIONS there is none, and that is the point: organizations minted before the type was required
+ * (the platform's own seeds, the first-administrator bootstrap) were typeless, and the engine repairs them before
+ * the first read that would refuse them. `basis` is what makes that repair legible as a derivation instead of a
+ * write nobody made, and those rows carry no `userId` because the application-scope repair has no initiator.
+ *
+ * For {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION} there IS one. It rides where every other
+ * operator action's actor does — on the audit ROW, resolved from the execution context — rather than as a field
+ * here, so an access review reads it the same way it reads a suspension or an ownership grant. What this schema
+ * adds for that basis is the one thing the row cannot carry: the operator's stated REASON (`RESOURCE_OPERATION_PERFORMED`
+ * carries no request payload, which is how `grantOwnership`'s required justification went unrecorded for months — #593).
+ *
+ * assurance-control: WILDO.AUDIT.SECURITY_EVENT — an authentication-relevant attribute of a tenant changed, and the
+ * record says what decided it and, when a person did, who and why.
+ */
+export const AuditableEvent_Organization_TypeAssignedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_TYPE_ASSIGNED),
+    organizationId: z.string(),
+    /** The declared organization type now stored on the row. */
+    organizationType: z.string(),
+    /**
+     * The type the row stored before, when it stored one the configuration no longer declares. Absent for an organization
+     * that had no type. Recorded because this assignment REPLACES a value someone once chose: a type removed from the
+     * declaration by mistake is recovered from exactly this field.
+     */
+    previousType: z.string().optional(),
+    basis: z.enum(OrganizationTypeAssignmentBasis),
+    /**
+     * The operator's stated reason, on the ONE basis that has a person behind it —
+     * {@link OrganizationTypeAssignmentBasis.OPERATOR_PROMOTION}, whose `requestDto` requires it.
+     *
+     * Optional on the schema because the two derivation bases have nothing to justify: a required field
+     * would force the boot repair to invent a sentence, and an invented justification is worse than an
+     * absent one — it reads as a decision somebody made.
+     *
+     * Recorded HERE rather than left on the request because a required field nothing stores is a promise
+     * nobody keeps, and `RESOURCE_OPERATION_PERFORMED` (which the CRITICAL promotion also emits) carries
+     * no request payload.
+     */
+    justification: z.string().optional(),
+});
 export const AuditableEvent_Organization_DeletedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.ORGANIZATION_DELETED),
     organizationId: z.string(),
@@ -1515,13 +2013,14 @@ export const AuditableEvent_Organization_ActivatedEventDataSchema = z.object({
  */
 export const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknown());
 /**
- * The application's authored authentication policy changed between two boots.
+ * The application's authored authentication or audit-viewer admission policy changed between two boots.
  *
  * The per-user-type authentication policy (`userTypes.<type>.auth` — MFA, password, and lockout
  * requirements) is STATIC application configuration authored in code and taken into effect at backend
  * startup. A change to it — most consequentially a WEAKENING such as turning MFA off — is a
  * security-posture decision that, before this event, left no product-side record: only the source
- * history showed it. This event closes that gap.
+ * history showed it. This event closes that gap. The effective `auditTrail.applicationReadAccess`
+ * posture is recorded separately from the user-type snapshots and compared independently.
  *
  * It is emitted at boot, by the system, when the resolved policy snapshot differs from the last one
  * recorded in the trail (detected by comparing against the most recent event of this type for the
@@ -1539,13 +2038,15 @@ export const ApplicationAuthPolicySnapshotSchema = z.record(z.string(), z.unknow
  */
 export const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.APPLICATION_AUTH_POLICY_CHANGED),
-    applicationId: z.string(),
-    /** Which user types' policies differed from the previously-recorded snapshot. Sorted, non-empty. */
+    // The owning application identity lives on the audit row, resolved by the shared writer before
+    // database/SIEM/immutable-sink fanout. It is not duplicated inside this policy payload.
+    /** Which user types' policies differed. Sorted; empty when only the audit-viewer access posture changed. */
     changedUserTypes: z.array(z.string()),
     /**
      * A stable digest of the `after` snapshot. Boot change-detection compares the current digest
      * against the digest carried by the most recent recorded event of this type; equal digests are the
-     * signal to emit nothing, so the trail carries one row per genuine change, not one per boot.
+     * authentication-policy comparison. Audit-viewer access is compared independently; equal digests
+     * alone do not suppress an access-policy change.
      */
     snapshotDigest: z.string(),
     /**
@@ -1555,6 +2056,15 @@ export const AuditableEvent_ApplicationAuthPolicyChanged_EventDataSchema = z.obj
     before: z.record(z.string(), ApplicationAuthPolicySnapshotSchema).nullable(),
     /** The per-user-type policy snapshot that took effect at this boot. Keys are user-type identifiers. */
     after: z.record(z.string(), ApplicationAuthPolicySnapshotSchema),
+    /**
+     * Effective audit-viewer access posture, separately typed from authentication user types.
+     * Absent on historical events predating this evidence. A null before means no prior recorded
+     * policy is known, not that an earlier deployment was strict or role based.
+     */
+    auditApplicationReadAccess: z.object({
+        before: z.enum(AuditApplicationReadAccess).nullable(),
+        after: z.enum(AuditApplicationReadAccess),
+    }).optional(),
 });
 /**
  * A governed lifecycle transition changed a subject's `status`.
@@ -1629,6 +2139,7 @@ export const AuditableEvent_OrganizationUnit_UpdatedEventDataSchema = z.object({
 });
 // SSO Authentication Event Data Schemas
 export const AuditableEvent_User_SSOLoginEventDataSchema = z.object({
+    assurance: ExternalAssuranceAssessmentSchema.optional(),
     eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN),
     userId: z.string(),
     email: z.email(),
@@ -1669,6 +2180,7 @@ export const AuditableEvent_User_SSOLoginEventDataSchema = z.object({
     }
 });
 export const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({
+    assurance: ExternalAssuranceAssessmentSchema.optional(),
     eventType: z.literal(CoreAuditableEventType.USER_SSO_LOGIN_FAILED),
     email: z.email().optional(),
     providerRef: z.string().optional(),
@@ -1681,15 +2193,46 @@ export const AuditableEvent_User_SSOLoginFailedEventDataSchema = z.object({
     ipAddress: z.string(),
     userAgent: z.string(),
 });
+/**
+ * A sign-in was refused because the claiming scope requires SSO (#1242).
+ *
+ * `organizationId` was REQUIRED here, and that is what made the event unemittable at half its own
+ * refusal sites: `enforcement.requireSSO` lives on the POLYMORPHIC SSO config, so an APPLICATION-scope
+ * policy refuses sign-ins for the application itself and there is no organization to name. Requiring
+ * one would have left exactly those refusals with no trail — the outcome this CRITICAL event exists to
+ * prevent. It now carries either scope and refuses anything but exactly one, following
+ * `EMERGENCY_ACCESS_USED`, which was widened for the same reason on the same config.
+ *
+ * `attemptedProviderRef` and `attemptedConnectionType` are OPTIONAL because two of the four refusal
+ * sites have no attempted provider at all: a password sign-in and a registration are refused BECAUSE
+ * no SSO was attempted. Requiring them would have forced a placeholder, and a placeholder in an
+ * audit row is worse than an absent field — it is a fact nobody can distinguish from a real one.
+ */
 export const AuditableEvent_User_SSOEnforcementBlockedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED),
     email: z.email(),
-    attemptedProviderRef: z.string(),
-    attemptedConnectionType: z.enum(SsoConnectionType),
-    organizationId: z.string(),
+    attemptedProviderRef: z.string().optional(),
+    attemptedConnectionType: z.enum(SsoConnectionType).optional(),
+    scopeType: z.enum(AuthScopeType),
+    organizationId: z.string().optional(),
+    applicationId: z.string().optional(),
     enforcementPolicy: z.string(),
     ipAddress: z.string(),
     userAgent: z.string(),
+}).superRefine((event, ctx) => {
+    const hasOrganizationScope = event.scopeType === AuthScopeType.ORGANIZATION
+        && event.organizationId !== undefined
+        && event.applicationId === undefined;
+    const hasApplicationScope = event.scopeType === AuthScopeType.APPLICATION
+        && event.applicationId !== undefined
+        && event.organizationId === undefined;
+    if (!hasOrganizationScope && !hasApplicationScope) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['scopeType'],
+            message: 'SSO-enforcement-blocked events require exactly one explicit tenant scope',
+        });
+    }
 });
 export const AuditableEvent_User_TokenRefreshedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_TOKEN_REFRESHED),
@@ -1707,13 +2250,33 @@ export const AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema
     affectedProviderRef: z.string().optional(),
     changes: z.record(z.string(), z.any()).optional(),
 });
-export const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({
-    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),
+/**
+ * The fields every SIEM export-configuration event carries; three kinds share them (#986) and differ
+ * only in what they SAY happened, which is what a SIEM rule keys on.
+ */
+const SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS = {
     organizationId: z.string(),
     changedBy: z.string(),
     changeType: z.enum(SiemExportChangeType),
+    /** The destination HOST only — a collector secret can live in the URL path, and this row is immutable. */
     webhookUrlDomain: z.string().optional(),
     eventFormatConfigured: z.string().optional(),
+    /** NAMES of the configuration fields the write changed; never their values (the credential is among them). */
+    changedFields: z.array(z.string()).optional(),
+};
+export const AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_CONFIGURED),
+    ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,
+});
+/** Export turned OFF (#986). Same fields; its own kind so it classifies CRITICAL. */
+export const AuditableEvent_Organization_SIEMExportDisabledEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DISABLED),
+    ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,
+});
+/** Export re-pointed at another destination (#986). Same fields; its own kind so it classifies WARNING. */
+export const AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.ORGANIZATION_SIEM_EXPORT_DESTINATION_CHANGED),
+    ...SIEM_EXPORT_CONFIGURATION_EVENT_FIELDS,
 });
 // Organization Provider Credential Event Data Schemas
 //
@@ -1785,6 +2348,13 @@ export const AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema =
     resolvedFrom: z.enum(ProviderCredentialResolutionSource),
     /** Absent when `resolvedFrom` is the deployment environment — there is no row to name. */
     credentialId: z.string().optional(),
+    /**
+     * WHOSE credential was spent: the member who set it. For a USER-delegated organization connection
+     * that is the person whose own vendor account every member's call acts through — the vendor
+     * attributes the act to them, so the trail must too (decision on wildo-ai/wildo-ai#18). Absent for
+     * a deployment-environment resolution, and for a row set with no recorded member.
+     */
+    credentialSetByUserId: z.string().optional(),
 });
 /**
  * The grant ended — by the tenant removing it, or by the tenant itself being purged.
@@ -1803,6 +2373,20 @@ export const AuditableEvent_OrganizationProviderCredential_DeletedEventDataSchem
     deletedBy: z.string().optional(),
     credentialId: z.string(),
     reason: z.enum(ProviderCredentialDeletionReason),
+    /**
+     * What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).
+     *
+     * Deleting our copy stops the application using a token; it does not end the grant at the vendor,
+     * and a refresh token frequently never expires on its own. So this field is the difference between
+     * a trail that says "we deleted our copy" and one that says whether the person's access was
+     * actually withdrawn where it lives.
+     *
+     * ABSENT rather than a member when nothing was attempted — an organization purge through the raw
+     * repository has no token to hand back. `not_declared` is the ordinary answer for a vendor whose
+     * revocation is not RFC 7009-shaped, and for a pasted credential that was never a grant; it is a
+     * recorded fact, not a failure.
+     */
+    vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),
 });
 /**
  * A PERSON connected their own account at a third party to this application.
@@ -1888,6 +2472,14 @@ export const AuditableEvent_OrganizationProviderConnection_GrantedEventDataSchem
     grantedScopes: z.array(z.string()).optional(),
     accountRef: z.string().optional(),
     replacedExistingConnection: z.boolean(),
+    /**
+     * On whose behalf the linked account acts. `user` means `grantedByUserId` linked THEIR OWN vendor
+     * account for the organization, and every member's call will act through it (decision on
+     * wildo-ai/wildo-ai#18) — which is why the grantor is named and the acknowledgement below recorded.
+     */
+    delegation: z.enum(ExternalProvider_Connection_DelegationMode).optional(),
+    /** The grantor acknowledged, before consenting at the vendor, that the whole organization will use their account. */
+    organizationWideUseAcknowledged: z.boolean().optional(),
 });
 /**
  * The stored VALUE changed for a person's credential that already existed.
@@ -1928,25 +2520,47 @@ export const AuditableEvent_UserProviderCredential_UsedEventDataSchema = z.objec
     credentialId: z.string(),
 });
 /**
- * The person's grant ended — by them removing it, or by their own erasure.
+ * The person's grant ended — by them removing it, by their own erasure, or by their account being deleted.
  *
  * `reason` matters more here than on the organization sibling. A credential removed by a cascade
  * from a subject-erasure request is EVIDENCE that the erasure reached this store, and it is the
  * evidence an operator produces when asked whether a person's third-party keys were destroyed. The
  * row itself is gone by then, so the event is all that remains.
  *
+ * `deletedBy` exists for the one reason whose actor is NOT the person: `reason: USER_DELETED`, an
+ * account deletion (#1016) — an administrator's hard delete or the invitation sweep reaping a pending
+ * user — where it names the deleting principal (the administrator's user id, or the `SYSTEM` sentinel).
+ * Absent on the owner's own revoke, whose actor is `userId` by construction.
+ *
  * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority
  * was withdrawn.
- * assurance-control: WILDO.PRIVACY.ERASURE — evidence that erasure destroyed the subject's
- * third-party credentials.
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — evidence that erasure destroyed the
+ * subject's third-party credentials: one row per destroyed credential with `reason: USER_ERASED`,
+ * written by the credential resource's parent-cascade removal observer because the erasure cascade
+ * removes these rows through the raw repository (#975).
  */
 export const AuditableEvent_UserProviderCredential_DeletedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_PROVIDER_CREDENTIAL_DELETED),
     userId: z.string(),
     providerRef: z.string(),
     secretSlug: z.string(),
+    deletedBy: z.string().optional(),
     credentialId: z.string(),
     reason: z.enum(ProviderCredentialDeletionReason),
+    /**
+     * What telling the VENDOR achieved, when the delete ended an OAuth2 grant (#545).
+     *
+     * Deleting our copy stops the application using a token; it does not end the grant at the vendor,
+     * and a refresh token frequently never expires on its own. So this field is the difference between
+     * a trail that says "we deleted our copy" and one that says whether the person's access was
+     * actually withdrawn where it lives.
+     *
+     * ABSENT rather than a member when nothing was attempted — an organization purge through the raw
+     * repository has no token to hand back. `not_declared` is the ordinary answer for a vendor whose
+     * revocation is not RFC 7009-shaped, and for a pasted credential that was never a grant; it is a
+     * recorded fact, not a failure.
+     */
+    vendorRevocation: z.enum(ProviderOAuth2RevocationOutcomeValues).optional(),
 });
 // Outbound M2M Webhook Event Data Schemas
 /**
@@ -2072,6 +2686,18 @@ export const AuditableEvent_User_RegisteredEventDataSchema = z.object({
     email: z.string(),
     ipAddress: z.string(),
     userAgent: z.string(),
+    /**
+     * HOW the account was acquired — the same vocabulary the registration policy is authored in, so "who
+     * registered through which door" is answered by the trail rather than reconstructed from neighbouring
+     * events. A first social or enterprise sign-in creates an account exactly as `/auth/register` does, and
+     * until #1141 only the password door recorded it.
+     *
+     * Optional on the schema only because rows written before the field existed carry none; every emitter
+     * states it (`logUserRegistered` requires it).
+     */
+    acquisitionChannel: z.enum(RegistrationAcquisitionChannel).optional(),
+    /** The external identity provider that vouched for the account, for a social or enterprise sign-in. */
+    providerRef: z.string().optional(),
 });
 export const AuditableEvent_User_EmailVerifiedEventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.USER_EMAIL_VERIFIED),
@@ -2321,6 +2947,29 @@ export const AuditableEvent_OAuth2ProviderBlockedEventDataSchema = z.object({
         });
     }
 });
+/**
+ * Authentication-context demand unsatisfied (issue #444).
+ *
+ * Carries BOTH sides of the comparison, because either alone is unactionable: `demandedAcrValues`
+ * is what the connection authored, `receivedAcr` is what the provider's ID token reported. The
+ * received value is OPTIONAL and its absence is the distinct, common case — a provider that emits
+ * no `acr` claim at all — which reads very differently from one that answered with a weaker
+ * context, and an operator must be able to tell them apart from the trail alone.
+ *
+ * No email field. The refusal happens before any identity is established or trusted, and recording
+ * an unauthenticated claimant's address as though it were a subject is the kind of quiet personal
+ * data this family avoids; `providerRef` and the two ACR sides are what a reader needs.
+ */
+export const AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.OIDC_ACR_DEMAND_UNSATISFIED),
+    providerRef: z.string(),
+    /** The ordered list of acceptable values the connection authored. Never empty — an empty demand is not enforced at all. */
+    demandedAcrValues: z.array(z.string()).min(1),
+    /** What the ID token's `acr` claim reported. ABSENT when the provider emitted no claim. */
+    receivedAcr: z.string().optional(),
+    /** Present when the ID token itself could not be read, which is a different refusal from a mismatched claim. */
+    failureReason: z.string().optional(),
+});
 // Emergency Access Event Data Schema
 /**
  * A named break-glass account signed in past its tenant's own SSO requirement (#423).
@@ -2404,7 +3053,8 @@ export const AuditableEvent_FieldAccess_EventDataSchema = z.object({
  *
  * ## Correlation across a cascade
  *
- * Every execution surface emits — API, internal call, and repository-only — so one tenant deletion
+ * The framework-managed lane covers API, internal call and repository-only writes; OVERRIDE_ALL
+ * implementations own their committed emission. A framework-managed tenant deletion
  * produces one row per cascaded child. The top-level `correlationId` is inherited by every sub-call
  * context and preserved across mid-flight operation corrections, so it groups the whole fan-out to one request;
  * `subCallDepth` separates the initiating operation (0) from what it cascaded into.
@@ -2413,7 +3063,8 @@ export const AuditableEvent_FieldAccess_EventDataSchema = z.object({
  *
  * `changedFields` names every field the write touched — a field NAME is not personal data, so it is
  * always safe and always recorded. `fieldEvidence` carries before/after VALUES only for fields the
- * schema marks `.isAuditEvidence()`.
+ * schema marks `.isAuditEvidence()`. The separate `reason` records an explicitly selected operator
+ * justification, not an arbitrary request payload or a copy of a mutable resource reason field.
  *
  * Values are limited on purpose: audit rows replicate to the per-org SIEM and to the immutable
  * ledger, and **the immutable ledger cannot be scrubbed** — so copying arbitrary personal data into
@@ -2443,10 +3094,26 @@ export const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.objec
     /** `true` for the bulk form, whose subject is a set rather than one row. */
     isBulkOperation: z.boolean().optional(),
     // ── Subject ──
-    /** The row acted on. Absent for bulk operations, which name a count instead. */
+    /** The row acted on. Absent for bulk operations, whose subject is the set below. */
     resourceId: z.string().optional(),
     /** Bulk operations only: how many rows the write affected. */
     affectedRecordCount: z.number().optional(),
+    /**
+     * Bulk operations only: WHICH rows the write affected.
+     *
+     * A count answers "how much"; a trail has to answer "what". Without this, one actor changing
+     * forty rows left a single record saying `affectedRecordCount: 40` and naming none of them — so
+     * the question an investigator asks first, "who changed THIS row", had no answer for any write
+     * that was not single-row, which is exactly the case where one actor touches many records at once.
+     *
+     * Bounded by the batch maximum a synchronous bulk already enforces, so this is a complete list
+     * rather than a sample: the background lane does not produce it at all, because it runs the
+     * single-row twin per id and each row audits itself.
+     *
+     * Rides `eventData`, which the audit store persists as an unparsed record — so naming the rows
+     * costs no column and no migration.
+     */
+    affectedResourceIds: z.array(z.string()).optional(),
     // ── Principal (the row's `userId` / `organizationId` / `applicationId` carry the identity) ──
     /**
      * The caller's roles AS THEY WERE at decision time. Roles are the framework's single
@@ -2463,6 +3130,12 @@ export const AuditableEvent_ResourceOperationPerformed_EventDataSchema = z.objec
     /** `0` for the operation the caller invoked; deeper for what it cascaded into. */
     subCallDepth: z.number(),
     // ── Effect ──
+    /**
+     * Operator justification explicitly selected from the request by the operation's audit contract.
+     * Historical evidence, independent of mutable resource fields such as cancellationReason.
+     * It is not inferred from arbitrary request fields and must not contain secrets.
+     */
+    reason: z.string().optional(),
     /** Every field the write touched. Names only — always safe, always recorded. */
     changedFields: z.array(z.string()).optional(),
     /**
@@ -2592,8 +3265,25 @@ export const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.obj
     transition: z.enum(PlatformAccessGrantLifecycleTransition),
     /** The grant, so the whole timeline can be reassembled from its rows. */
     grantId: z.string(),
-    /** The tenant that was, or would have been, reached into. */
-    targetOrganizationId: z.string(),
+    /**
+     * WHAT the elevation reaches, and therefore who was entitled to approve it.
+     *
+     * Carried explicitly rather than inferred from the presence of `targetOrganizationId`: a reviewer
+     * asking "was this approved by the party the rules require?" needs the SCOPE, and deriving it from
+     * a field's absence would make a lost or scrubbed value read as an application-wide elevation.
+     *
+     * `TENANT` is the default so every row written before this axis existed keeps its true meaning —
+     * the application-wide grant did not exist then.
+     */
+    grantScope: z.enum(PlatformAccessGrantScope).default(PlatformAccessGrantScope.TENANT),
+    /**
+     * The tenant that was, or would have been, reached into.
+     *
+     * OPTIONAL since the application-wide scope arrived: that grant names no tenant, and writing a
+     * placeholder would be a lie about which customer an operator reached. Absent ⇔
+     * `grantScope === APPLICATION_WIDE`.
+     */
+    targetOrganizationId: z.string().optional(),
     /** The operator who asked. Never the decider — see {@link decidedByUserId}. */
     operatorUserId: z.string(),
     /** Why the operator said they needed access. Recorded on every transition, not only the request. */
@@ -2608,6 +3298,51 @@ export const AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema = z.obj
     decidedByUserId: z.string().optional(),
     /** Their stated reason, when they gave one. */
     decisionReason: z.string().optional(),
+    /**
+     * The machine credential an application-wide grant is bound to, when it is (#297). Present on EVERY transition
+     * of such a grant, so the second administrator's signature and every later reader see which credential the
+     * elevation reaches — a request naming a machine must never read, in the trail, as the requester's own window.
+     */
+    grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),
+});
+/**
+ * One transition in the life of a system-of-record partition assignment.
+ *
+ * Read it to answer "who could see this remote company, and when did that start or stop". The row
+ * names both units on a move, so a timeline reconstructed from these events is complete without
+ * joining anything: each row carries the state it left as well as the state it reached.
+ *
+ * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE
+ * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+ */
+export const AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_LIFECYCLE),
+    /** Which transition this row records. */
+    transition: z.enum(SystemOfRecordPartitionAssignmentTransition),
+    /** The assignment row, so its whole timeline can be reassembled. */
+    assignmentId: z.string(),
+    /** The declared instance — `systemsOfRecord.<name>`. Instance, never vendor: two Odoo deployments have unrelated company ids. */
+    system: z.string(),
+    /** The partition's key as the remote spells it, in canonical text. */
+    remoteKey: z.string(),
+    /**
+     * The unit the partition belongs to AFTER this transition.
+     *
+     * Absent exactly when the transition is `UNASSIGNED` — there is no resulting unit, and writing the
+     * departed one here would make an unassignment read as an assignment to the unit that lost it.
+     */
+    organizationUnitId: z.string().optional(),
+    /**
+     * The unit the partition belonged to BEFORE this transition.
+     *
+     * Present on `REASSIGNED` and `UNASSIGNED`, absent on `ASSIGNED`. This is the field the automatic
+     * `RESOURCE_OPERATION_PERFORMED` row cannot carry, and the reason this event type exists.
+     */
+    previousOrganizationUnitId: z.string().optional(),
+    /** The operator's stated reason. Recorded on every transition, not only the first. */
+    justification: z.string().optional(),
+    /** The operator who made the change. */
+    assignedByUserId: z.string().optional(),
 });
 export const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.CROSS_TENANT_ADMINISTRATIVE_ACCESS),
@@ -2635,6 +3370,14 @@ export const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.
      * and on any crossing admitted before grants were required.
      */
     authorizingGrantId: z.string().optional(),
+    /**
+     * WHICH COLLECTION {@link authorizingGrantId} names.
+     *
+     * A grant id alone is not resolvable: `platformAccessGrants` and `applicationAccessGrants` are two
+     * resources with two collections, and a reviewer handed only an id has to try both. Absent exactly
+     * when `authorizingGrantId` is.
+     */
+    authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),
     /**
      * Did the operation variant DECLARE this crossing (`admitsCrossTenantPlatformAdministration`)?
      *
@@ -2647,6 +3390,12 @@ export const AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema = z.
     initiatorRoles: z.array(z.string()),
     /** How the call was initiated — separates a human operator from framework machinery. */
     executionType: z.enum(ExecutionContext_ExecutionType),
+    /**
+     * The credential that read, when the reader is a MACHINE. A machine has no `userId`, so without this the
+     * row names no reader at all — an assurance collector's reads would be unattributable in the very trail it
+     * measures, and could not be told apart from its own earlier runs (#297). Absent for a human operator.
+     */
+    machineCredential: ExecutionContext_MachineCredentialSchema.optional(),
 });
 /**
  * An application-wide directory enumeration.
@@ -2683,6 +3432,21 @@ export const AuditableEvent_PlatformDirectoryAccess_EventDataSchema = z.object({
     initiatorRoles: z.array(z.string()),
     /** How the call was initiated — separates a human operator from framework machinery. */
     executionType: z.enum(ExecutionContext_ExecutionType),
+    /**
+     * The application-wide elevation that authorised this directory read.
+     *
+     * Until 2026-09-09 this event named NO elevation, because none was required — the read was gated on
+     * an administrator role alone while the far narrower per-row crossing required a usable, time-bound,
+     * approved grant. That inversion is what `applicationAccessGrants` closes, and this field is the
+     * evidence half of the closure: it is what joins a directory read to the two administrators who
+     * signed for it.
+     *
+     * Absent on a read the admission does not gate — an exempt execution type (batch, webhook), or a
+     * read the confinement authority confined, neither of which is an elevation.
+     */
+    authorizingGrantId: z.string().optional(),
+    /** WHICH collection {@link authorizingGrantId} names. Absent exactly when it is. */
+    authorizingGrantScope: z.enum(PlatformAccessGrantScope).optional(),
 });
 export const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.RESOURCE_OPERATION_DENIED),
@@ -2719,6 +3483,30 @@ export const AuditableEvent_ResourceOperationDenied_EventDataSchema = z.object({
      * the operation's config as it stood that day.
      */
     requiredRoles: z.array(z.string()).optional(),
+    /**
+     * The roles the caller tried to GRANT and could not — present only on
+     * {@link ResourceOperationDenialReason.ROLE_CEILING_EXCEEDED}.
+     *
+     * A third set, distinct from both of its neighbours and not expressible by either: `requiredRoles`
+     * is what the OPERATION demanded of the caller, `initiatorRoles` is what the caller HELD, and this
+     * is what the caller attempted to confer on somebody else. It is the whole content of an
+     * escalation attempt — "an ORG_ADMIN asked for ORG_OWNER" — and without it the row says only that
+     * a ceiling was hit.
+     *
+     * Only the REFUSED subset is recorded, not the whole requested array: the roles the caller was
+     * entitled to grant are not evidence of anything, and the difference is what a reviewer reads.
+     */
+    escalatedRoles: z.array(z.string()).optional(),
+    /**
+     * The surface the person called, when the refusal happened on one that is NOT a resource operation — a
+     * manual-controller route (`GET /api/v1/charts/:chartId/data`) or a WebSocket event (`badge:get`).
+     *
+     * On such a surface the operation fields above name only the context it was authorized under (an
+     * application read), which on its own cannot tell a chart from a feature resolution (#534 third review L3).
+     * Absent on a resource operation, whose operation fields already ARE the surface. Carries a route TEMPLATE
+     * where one is known, so the trail records which door was refused rather than which row was asked for.
+     */
+    refusedSurface: z.string().optional(),
     /**
      * The caller's roles AS THEY WERE at decision time — empty when the refusal WAS the absence of
      * them ({@link ResourceOperationDenialReason.MISSING_INITIATOR}).
@@ -2788,6 +3576,58 @@ export const AuditableEvent_RetainedDataAccess_EventDataSchema = z.object({
     organizationId: z.string().optional(),
     ipAddress: z.string().optional(),
 });
+/**
+ * A person met a governed document, and this is the release they met.
+ *
+ * `interaction` is the composed record from `composeGovernedDocumentInteraction`, which has already
+ * refused anything the release does not permit and marked anything the workflow has not finished.
+ * It is nested rather than flattened so there is ONE shape for a governed-document interaction — a
+ * second, flatter copy here would be a second thing to keep in step with the release vocabulary.
+ *
+ * The SUBJECT is the audit envelope's own actor attribution plus `userId` here, never a third
+ * spelling inside the record; see the interaction schema's JSDoc for why.
+ *
+ * assurance-control: WILDO.PRIVACY.CONSENT_RECORD
+ */
+export const AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.GOVERNED_DOCUMENT_INTERACTION_RECORDED),
+    /**
+     * The identified person who met the document. Absent exactly when `anonymousUserId` is present
+     * (#1258 Step 5) — a signed-in registrant or an already-identified reader has one; a visitor
+     * reading a public notice before ever creating an account does not.
+     */
+    userId: z.string().optional(),
+    /**
+     * The pre-identity visitor who met the document, when nobody is signed in (#1258 Step 5).
+     * `AnonymousUser._id` / `ExecutionContext.anonymousUserId` — the same identity Step 1's consent
+     * carry is keyed on, never a second visitor-identity concept.
+     */
+    anonymousUserId: z.string().optional(),
+    /** What they did, which release they did it to, and that release's standing at the time. */
+    interaction: GovernedDocumentInteractionSchema,
+    /**
+     * TRUE-but-unfinished notes carried from composition — today, that the release was UNAPPROVED.
+     *
+     * Recorded rather than discarded because an advisory is the only trace that the mechanism
+     * proceeded deliberately rather than by omission.
+     */
+    advisoryKinds: z.array(z.string()),
+    ipAddress: z.string().optional(),
+}).superRefine((event, context) => {
+    // Exactly one subject, never zero (a record naming nobody is not a record) and never both (two
+    // identities for one act is two different claims about who acted).
+    const hasUser = event.userId !== undefined;
+    const hasAnonymous = event.anonymousUserId !== undefined;
+    if (hasUser === hasAnonymous) {
+        context.addIssue({
+            code: 'custom',
+            path: hasUser ? ['anonymousUserId'] : ['userId'],
+            message: hasUser
+                ? 'a governed-document interaction names both userId and anonymousUserId — exactly one subject met the document'
+                : 'a governed-document interaction names neither userId nor anonymousUserId — a record must name who met the document',
+        });
+    }
+});
 /**
  * A DATA SUBJECT EXPORT — the compliance record of the framework assembling everything it holds
  * about one person and disclosing it.
@@ -2882,6 +3722,198 @@ export const AuditableEvent_CollectionDataExport_EventDataSchema = z.object({
     /** Tenant scope, when the export ran org-scoped. */
     organizationId: z.string().optional(),
 });
+/**
+ * The application CALLED a declared operation on a third-party provider (S3a/S3b; see the enum
+ * member's docstring for why this is neither an HTTP_API read-through nor a credential-use event).
+ *
+ * One event per OUTBOUND CALL, emitted on both the success and the failure path. Recording only
+ * what worked would hide the attempts, and a refused or failed outbound call is exactly what a
+ * reviewer wants to see first.
+ *
+ * Ids and SHAPE only, never a payload. There is no field for the request body, the response body or
+ * the credential — a structural property of this schema rather than a redaction step somebody has to
+ * remember, for the same reason the credential family carries no value field.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account
+ * an outbound call spent, which the initiator's own ids cannot answer once one execution may spend
+ * several.
+ */
+export const AuditableEvent_ProviderOperationCall_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_CALL),
+    /** The provider whose catalogue declared the operation (e.g. `slack`). */
+    providerRef: z.string().trim().min(1),
+    /** The operation id as the catalogue declares it. */
+    operationId: z.string().trim().min(1),
+    /** The catalogue domain the operation belongs to. */
+    domain: z.string().trim().min(1),
+    /** The HTTP method the compiled request used. */
+    method: z.string().trim().min(1),
+    /** `READ` | `WRITE`, as the operation declares its effect — the axis a reviewer filters on first. */
+    classification: z.string().trim().min(1),
+    /**
+     * WHOSE ACCOUNT the call spent: `application` | `organization` | `user`.
+     *
+     * Deliberately separate from `organizationId` below, which records the tenant the REQUEST was
+     * scoped to. Those are the same tenant in the ordinary case and different ones exactly where it
+     * matters — a trail carrying only the initiator's organization would attribute a fan-out's calls
+     * to the wrong tenants.
+     */
+    connectionOwnerScope: z.string().trim().min(1),
+    /** The owner's id, absent for an application-owned call which names no second party. */
+    connectionOwnerId: z.string().optional(),
+    /** `service` | `user` — whether the call acted for the owner itself or on a person's delegation. */
+    connectionDelegation: z.string().trim().min(1),
+    /** HTTP status of the answer; absent when the call never got one. */
+    status: z.number().int().optional(),
+    /** Present when the call failed, naming the failure KIND rather than the vendor's prose. */
+    failureKind: z.string().optional(),
+    /**
+     * The `requiredScopes` verdict (#979) — present only when the operation declares required scopes. `not_recorded`
+     * is the one to read twice: the call went out without its scopes being checked.
+     */
+    scopeCheck: z.enum(ProviderOperationScopeCheck).optional(),
+    /** The required scopes the grant lacked — present with `scopeCheck: missing`. Scope names only, never a token. */
+    missingScopes: z.array(z.string()).optional(),
+    /** The REAL initiating user — absent only for genuine machine/internal executions. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that acted, for the machine/internal cases. */
+    executionType: z.string().optional(),
+    /** The tenant the REQUEST was scoped to — see `connectionOwnerScope`. */
+    organizationId: z.string().optional(),
+});
+/**
+ * The browser door REFUSED a provider operation (#367) — see the enum member for why this is not a
+ * failed call.
+ *
+ * Ids and shape only, like its call sibling: the request's `input` is never recorded. What the caller
+ * ASKED FOR is recorded even when it names nothing real, because a refusal records an attempt rather
+ * than proving the provider or operation exists.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ */
+export const AuditableEvent_ProviderOperationDenied_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.PROVIDER_OPERATION_DENIED),
+    denialReason: z.enum(ProviderOperationDenialReason),
+    /** The provider the request named. */
+    providerRef: z.string().trim().min(1),
+    /** The operation id the request named. */
+    operationId: z.string().trim().min(1),
+    /** The account the request asked to spend: `application` | `organization` | `user`. */
+    connectionOwnerScope: z.string().trim().min(1),
+    /** The owner's id, absent for an application-owned request. */
+    connectionOwnerId: z.string().optional(),
+    /** `service` | `user`, as requested. */
+    connectionDelegation: z.string().trim().min(1),
+    /**
+     * The roles the policy required — present on {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}
+     * and {@link ProviderOperationDenialReason.ROLES_NOT_APPLICABLE_TO_TARGET}.
+     */
+    requiredRoles: z.array(z.string()).optional(),
+    /**
+     * The roles the caller held IN THE SCOPE THAT WAS CHECKED, at decision time — present on
+     * {@link ProviderOperationDenialReason.INSUFFICIENT_ROLES}, so the row explains itself.
+     */
+    heldRoles: z.array(z.string()).optional(),
+    /** The refused person. Absent only on {@link ProviderOperationDenialReason.MISSING_USER_SESSION}. */
+    initiatorUserId: z.string().optional(),
+    /** The execution type that asked, which is what explains a missing user. */
+    executionType: z.string().optional(),
+    /** The tenant the REQUEST was scoped to. */
+    organizationId: z.string().optional(),
+});
+/**
+ * An agent reached an MCP server — the outbound trail for a tool call that leaves the trust
+ * boundary (#491).
+ *
+ * One event per ATTEMPT, successful or not. Recording only what worked would hide exactly what a
+ * reviewer wants first: the refused targets, the calls that timed out, and the tools that answered
+ * with their own error. `outcome` names which of those it was, in the client's own vocabulary, so
+ * the trail and the logs agree on the words.
+ *
+ * Ids, HOST and SHAPE only — never a payload. There is no field for the tool arguments, the tool
+ * result or the credential. That is a structural property of this schema rather than a redaction
+ * step somebody has to remember, the same choice the provider-call and credential families make.
+ * `destinationHost` and not the URL, because an MCP endpoint routinely carries a tenant or session
+ * identifier in its path.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records WHOSE third-party account
+ * an agent's tool call spent, which the initiator's own ids cannot answer once one turn may spend
+ * either the person's or the tenant's.
+ */
+export const AuditableEvent_McpToolCall_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.MCP_TOOL_CALL),
+    /** The server ref the application declared and the agent named. */
+    mcpServerRef: z.string().trim().min(1),
+    /** HOST only — see the docstring for why never the URL. */
+    destinationHost: z.string().trim().min(1),
+    /** The tool called. Absent when the attempt failed before any tool was chosen (discovery). */
+    toolName: z.string().optional(),
+    /** The client's outcome kind — `ok`, `refused_target`, `unreachable`, `timed_out`, `protocol_error`, `tool_error`. */
+    outcome: z.string().trim().min(1),
+    /**
+     * WHOSE ACCOUNT the call spent: `user` | `organization`. Absent when no credential was resolved,
+     * which is itself the reason the attempt failed.
+     *
+     * Separate from `organizationId` for the same reason as the provider-call event: those are the
+     * same tenant in the ordinary case, and different ones exactly where it matters.
+     */
+    connectionOwnerScope: z.string().optional(),
+    /** The credential row that was spent, for the audit trail. */
+    credentialId: z.string().optional(),
+    /**
+     * WHOSE credential it was: the member who set an organization credential. For an organization-lent
+     * member account (decision on wildo-ai/wildo-ai#18) that is the person the far server attributes the
+     * call to, captured at call time rather than joined later, since a reconnect moves it.
+     */
+    credentialSetByUserId: z.string().optional(),
+    /** The REAL initiating user — absent only for genuine machine/internal executions. */
+    initiatorUserId: z.string().optional(),
+    /** The tenant the turn was scoped to — see `connectionOwnerScope`. */
+    organizationId: z.string().optional(),
+    /** The agent whose declaration named the server, so a trail can be read back to a configuration. */
+    agentRef: z.string().optional(),
+});
+/**
+ * A human approver AUTHORED the arguments an approval-gated tool ran with (#566).
+ *
+ * One row per MODIFIED approval — never per approval. See the enum member's docstring for why an
+ * ordinary approval is not this event, and for why no argument VALUE appears in this schema.
+ *
+ * `proposedInputDigest` / `executedInputDigest` are the model SDK's own canonical input digests, the
+ * same values its approval signature is computed over. That is what makes them evidence rather than
+ * a convenience: a reader holding the executed call can recompute the second and see it match, and
+ * the two differing is proof that the call which ran is not the call which was proposed — with no
+ * copy of either payload on the trail.
+ *
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — records that an authorization
+ * decision REWROTE the act it authorized, and who made it.
+ */
+export const AuditableEvent_AgentToolApprovalModified_EventDataSchema = z.object({
+    eventType: z.literal(CoreAuditableEventType.AGENT_TOOL_APPROVAL_MODIFIED),
+    /** The conversational execution whose turn was paused. */
+    executionId: z.string().trim().min(1),
+    /** The pending decision's id — correlates this row with the pause and the resume in the logs. */
+    approvalId: z.string().trim().min(1),
+    /** The actor system the turn belongs to. */
+    systemRef: z.string().trim().min(1),
+    /** The agent whose declaration gated the tool, so a trail reads back to a configuration. */
+    agentRef: z.string().trim().min(1),
+    /** The approval-gated tool, as the model was shown it. */
+    toolName: z.string().trim().min(1),
+    /** Canonical digest of the arguments the MODEL proposed. */
+    proposedInputDigest: z.string().trim().min(1),
+    /** Canonical digest of the arguments that actually RAN. Differs from the above by construction. */
+    executedInputDigest: z.string().trim().min(1),
+    /**
+     * The argument NAMES the approver changed, sorted. Names only — a field name is not personal data,
+     * which is exactly why it is always safe and always recorded.
+     */
+    modifiedArgumentKeys: z.array(z.string()),
+    /** The approver. Absent never happens on this plane — only a present human can answer — but the envelope owns the field. */
+    approverUserId: z.string().optional(),
+    /** The tenant the turn was scoped to. */
+    organizationId: z.string().optional(),
+});
 /**
  * Rows were read THROUGH an HTTP-API resource binding — the read-through trail for data living in
  * an EXTERNAL system the platform does not own (ETL plan D8/R6; see the enum member's docstring
@@ -2933,6 +3965,9 @@ export const AuditableEvent_HttpApiReadThroughAccess_EventDataSchema = z.object(
  * assurance-control: WILDO.AUDIT.ATTRIBUTION — the outbound deletion names the subject it served
  * and the external system it reached; the erasure report is the per-request receipt, this row is
  * the queryable trail.
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — an erasure that deleted rows in an external
+ * system leaves a durable record naming that system and how many rows it deleted there.
  */
 export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.HTTP_API_EXTERNAL_ERASURE),
@@ -2964,6 +3999,9 @@ export const AuditableEvent_HttpApiExternalErasure_EventDataSchema = z.object({
  *
  * assurance-control: WILDO.AUDIT.ATTRIBUTION — an acknowledged erasure hole is recorded per
  * resource, per erasure request, never as a standing posture.
+ *
+ * assurance-control: WILDO.PRIVACY.ERASURE_PROPAGATION — a store the erasure deliberately did not
+ * reach is recorded as such, so the accounting cannot read as complete.
  */
 export const AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema = z.object({
     eventType: z.literal(CoreAuditableEventType.HTTP_API_NON_ERASURE_ACKNOWLEDGED),
@@ -3228,16 +4266,23 @@ export const AuditableEvent_DataSchema = z.record(z.string(), z.any());
 export const AuditableEvent_BaseSchema = z.object({
     _id: z.string().isPrimaryKey().isSummaryField(),
     /**
-     * Store-agnostic, server-minted correlation key (UUID). The Mongo `_id` is
+     * Store-agnostic, server-assigned correlation key (UUID). The Mongo `_id` is
      * THIS store's primary key, but immudb (and any future audit sink) has its
      * own native key — so cross-store correlation needs an id that belongs to the
-     * EVENT, not to one store. Minted in `AuditLogsBackendService._createAuditLog`
+     * EVENT, not to one store. Fixed in `AuditLogsBackendService._createAuditLog`
+     * — minted there, or supplied deterministically by a deferred recording (#535) —
      * BEFORE the DB write and carried on BOTH the DB row AND the provider fan-out
      * emission, so the Phase-3 completeness reconciler can match DB rows ⇄ immudb
      * records (and `AuditLogVerification.verifyAuditEvent(eventId)` resolves the
      * same key). Not the primary key: `_id` stays the DB PK.
+     *
+     * UNIQUE, because it names ONE event (#535). A caller that delivers an event at least once — an outbox relay replaying
+     * an audit record after a crash — supplies a deterministic `eventId`, and a redelivery then collides here instead of
+     * writing a second row. immudb (write-if-absent by `eventId`) and every SIEM wire format (whose dedup key is this
+     * value) are idempotent on the same id, so all three destinations agree on "once". Sparse, as `.isUnique()` defaults:
+     * a row written before `eventId` existed carries none and is not a duplicate of another.
      */
-    eventId: z.string().isDBIndexed(),
+    eventId: z.string().isDBIndexed().isUnique(),
     // Note: .optional() must come AFTER decorators to preserve optionality in TypeScript type inference
     userId: z.string().isSummaryField().optional(),
     /**
@@ -3353,6 +4398,7 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_User_AppRolesChangedEventDataSchema,
     AuditableEvent_Application_SuperAdminFloorBreachedEventDataSchema,
     AuditableEvent_Organization_OwnerFloorBreachedEventDataSchema,
+    AuditableEvent_Organization_TypeAssignedEventDataSchema,
     AuditableEvent_OrganizationMember_InvitedEventDataSchema,
     AuditableEvent_OrganizationMember_JoinedEventDataSchema,
     AuditableEvent_OrganizationMember_UpdatedEventDataSchema,
@@ -3380,6 +4426,8 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_User_TokenRefreshedEventDataSchema,
     AuditableEvent_Organization_SSOConfigurationChangedEventDataSchema,
     AuditableEvent_Organization_SIEMExportConfiguredEventDataSchema,
+    AuditableEvent_Organization_SIEMExportDisabledEventDataSchema,
+    AuditableEvent_Organization_SIEMExportDestinationChangedEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_SetEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_RotatedEventDataSchema,
     AuditableEvent_OrganizationProviderCredential_UsedEventDataSchema,
@@ -3414,6 +4462,7 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_User_PhoneVerifiedEventDataSchema,
     AuditableEvent_User_PhoneVerificationFailedEventDataSchema,
     AuditableEvent_OAuth2ProviderBlockedEventDataSchema,
+    AuditableEvent_OidcAcrDemandUnsatisfiedEventDataSchema,
     AuditableEvent_EmergencyAccess_UsedEventDataSchema,
     AuditableEvent_FieldAccess_EventDataSchema,
     AuditableEvent_ResourceOperationPerformed_EventDataSchema,
@@ -3421,11 +4470,15 @@ export const AuditableEvent_TypedDataSchema = z.discriminatedUnion('eventType',
     AuditableEvent_CrossTenantAdministrativeAccess_EventDataSchema,
     AuditableEvent_PlatformDirectoryAccess_EventDataSchema,
     AuditableEvent_PlatformAccessGrantLifecycle_EventDataSchema,
+    AuditableEvent_SystemOfRecordPartitionAssignmentLifecycle_EventDataSchema,
     AuditableEvent_RetainedDataAccess_EventDataSchema,
+    AuditableEvent_GovernedDocument_InteractionRecordedEventDataSchema,
     AuditableEvent_SubjectDataExport_EventDataSchema,
     AuditableEvent_CollectionDataExport_EventDataSchema,
     AuditableEvent_User_SessionEvictedEventDataSchema,
     AuditableEvent_HttpApiReadThroughAccess_EventDataSchema,
+    AuditableEvent_ProviderOperationCall_EventDataSchema,
+    AuditableEvent_ProviderOperationDenied_EventDataSchema,
     AuditableEvent_HttpApiExternalErasure_EventDataSchema,
     AuditableEvent_HttpApiNonErasureAcknowledged_EventDataSchema,
     AuditableEvent_User_CrossFrontendHandoffIssuedEventDataSchema,